Back to Checks
aws

Amazon SageMaker Model Registry should have at least one approved model package

sagemaker_models_registry_in_use
Service: sagemakerSeverity: low
OfficialBuilt-inVerified
Categories:gen-aisoftware-supply-chain
Resource Type:Other

SageMaker Model Registry is evaluated to verify that at least one Model Package Group exists and contains at least one model package with ModelApprovalStatus = Approved. This confirms that the ML governance workflow (register → review → approve → deploy) is actively in use.

Prowler logoProwlerprowler-provider-aws

Risk

An empty Model Registry, or one with no approved packages, indicates that models are being deployed outside any review process. This breaks provenance and accountability for production ML workloads, making it impossible to enforce governance controls such as auditing, versioning, and approval workflows.

Run this check with Prowler

Run in Prowler Cloud
Run
prowler aws --checks sagemaker_models_registry_in_use

Recommendation

Register all production models in the SageMaker Model Registry and enforce an approval workflow before deployment. Ensure at least one model package per group reaches Approved status. Use IAM policies to restrict who can approve model packages and integrate with CI/CD pipelines to automate registration.

Remediation

CLI

aws sagemaker list-model-package-groups
aws sagemaker list-model-packages --model-package-group-name <group-name>
aws sagemaker update-model-package --model-package-arn <arn> --model-approval-status Approved

Other

1In the AWS console, navigate to SageMaker > Models > Model Registry.
2Create a Model Package Group if none exists.
3Register a model version in the group.
4Review and approve at least one model package by setting its approval status to Approved.

Check Code

from prowler.lib.check.models import Check, Check_Report_AWS
from prowler.providers.aws.services.sagemaker.sagemaker_client import sagemaker_client


class sagemaker_models_registry_in_use(Check):
    """Ensure that SageMaker Model Registry has at least one approved model package."""

    def execute(self) -> list[Check_Report_AWS]:
        """Execute the check logic.

        Returns:
            A list of reports indicating whether the SageMaker Model Registry
            in each region contains at least one approved model package.
        """
        findings = []
        for registry in sagemaker_client.sagemaker_model_registries:
            report = Check_Report_AWS(metadata=self.metadata(), resource=registry)
            if not registry.has_groups:
                report.status = "FAIL"
                report.status_extended = f"SageMaker Model Registry in region {registry.region} has no Model Package Groups."
            elif registry.has_approved_packages:
                report.status = "PASS"
                report.status_extended = f"SageMaker Model Registry in region {registry.region} has at least one approved model package."
            else:
                report.status = "FAIL"
                report.status_extended = f"SageMaker Model Registry in region {registry.region} has Model Package Groups but no approved model packages."
            findings.append(report)
        return findings

References